Cybersecurity Analyst IV

Hybrid role in Sacramento with support for enterprise cybersecurity initiatives and opportunities to guide security strategy across multiple domains. This position provides advanced technical leadership, strengthens cybersecurity resilience for patient care and business operations, and contributes to risk reduction through monitoring, threat hunting, incident response, and risk management. The pay range for this Exempt position is $150,300.80 to $240,489.60 annually, with total compensation influenced by factors including experience, education, skills, licensure, certifications, departmental equity, training, and organizational needs.

What you’ll do

• Provide cybersecurity support, guidance, and technical leadership to Sutter Health operating units, entities, and the Cybersecurity Department to protect information systems, networks, data, and digital assets.
• Deliver advanced security administration, engineering, research, testing, monitoring, incident response, threat hunting, and risk management while supporting enterprise cybersecurity programs.
• Act as a trusted advisor to Information Security leadership, offering subject matter expertise across endpoint security, data protection, vulnerability management, SIEM, network security, and threat intelligence.
• Develop cybersecurity metrics, security insights, and risk-based recommendations to support decision-making.
• Support security awareness and human risk management initiatives.
• Mentor team members and help drive program maturity, operational effectiveness, and continuous improvement.
• Collaborate with technical and business stakeholders to improve operational effectiveness, enhance cybersecurity resilience, and support regulatory compliance.

Key responsibilities include

• Security consultation, risk assessments, policy reviews, and vendor/third-party security reviews with risk-based recommendations.
• Incident response support, including participating in security incident and post-incident response processes.
• Integrating and analyzing data from multiple cybersecurity technologies to identify risks, trends, and opportunities for operational improvement.
• Supporting investigations, workflow management, exception management, customer engagement, and cybersecurity operations processes using ServiceNow or similar platforms.
• Building cybersecurity analytics and reporting using SQL, Python, and Power BI for automation and data-driven risk reporting.

What you bring

• Bachelor’s in Business, Cyber Security, Risk Management, Information Technology, Computer Science, or related field. Equivalent experience may be accepted in lieu of the required degree or diploma.
• 8 years recent relevant experience.
• Experience supporting enterprise cybersecurity programs, including vulnerability management, threat intelligence, data protection, DLP, and risk reduction initiatives.
• Experience with Microsoft Defender, SIEM, and other enterprise cybersecurity platforms to support security monitoring and threat analysis.
• Hands-on experience with security awareness and phishing prevention, including workforce education and human risk management programs.
• Experience developing metrics, executive dashboards, KPIs, and risk reporting, including using SQL, Python, and Power BI.
• Professional cybersecurity certifications such as CISSP, GIAC, Microsoft Security, or equivalent advanced certifications.
• Thorough knowledge of information systems security concepts and current security trends and practices, including security processes and methods.
• General knowledge of Federal and State IS security and privacy-related regulatory requirements and laws; detailed familiarity with NIST, HIPAA, and FIPS and other recognized security standards and best practices.
• Detailed understanding of endpoint security technologies (Antivirus, Forensics, Anti-malware, HIPS) and endpoint operating systems (Windows and Linux), plus endpoint security controls such as ACLs, HIPS, registry, logging, and forensics.
• Understanding of the lifecycle of a network threat and network vulnerability exploitation in a healthcare environment.
• Advanced understanding of cyber attack anatomy, including Microsoft Windows workstation and server, Unix/Linux and network OSs, and working knowledge of internet technologies such as DNS, routing, SMTP, HTTP, DHCP, and FTP.
• Technical skills in planning, administration, and management of information systems and operational and technical security controls, including security risk analysis and management.
• Written and verbal communication skills to interact effectively with peers, users, and executives; ability to prioritize and multi-task.
• Ability to acquire images (remote or local) and conduct forensics in the context of an active attack.
• Proven ability to translate highly complex technical topics into language and diagrams understandable to a wide audience.

Schedule and work setup

• Location: Sacramento, CA (hybrid)
• In-office attendance: Regular in-office attendance is required; commute to the Sacramento office consistently to support team collaboration and business needs.
• Shift: Days
• Schedule: Full Time
• Days of the week: Monday to Friday
• Weekend requirements: As needed, occasionally
• Weekly hours: 40
• Position status: Exempt; Employee status: Regular; Union: No

Benefits

Benefits: Yes. Eligible positions also include a comprehensive benefits package.

Pay range: $150,300.80 to $240,489.60 per annual salary. Compensation range may vary by geographic location and considers factors such as experience, education, skills, licensure, certifications, departmental equity, training, and organizational needs. Base pay is only one component of Sutter Health’s comprehensive total rewards program.